Why do most commertial personal firewalls use NDIS hooking when it can be done with IM driver?
IMHO This question is asked by enyone who deal with filtering algorithm
If you are developing your apps for NT, I think it more easy and better to use IM miniport. My opinion that NDIS hooking is legacy of cross plaform developing for NT and 9x that was actual some yaers ago.
But I use NDIS hooking in my project. It is paradox. 🙂